1

The Current Setup

We have a number of machines spread across 13 /24 subnets. Presently we have a fairly dumb router that allows the routing of traffic between these subnets. This is not a firewall and it does not track state.

The Desired Setup

We wish to replace the router with firewalls (a pair of Juniper SRX 345s in a VC). This isn't a particularly easy process as once you start tracking state, you have idle connections timing out.

The applications aren't set up to deal with this and, this, migration to these new firewalls needs to be gradual. We cannot just rip out the routers and assign their IPs to the firewalls.

The Problem

Take the scenario when machine A (10.20.9.118/24) has been migrated to the new firewalls. Its gateway has been changed to point at the new firewall. Machine B (10.20.12.221/24) has not been migrated - its gateway still points at the old router.

In this scenario, traffic from A to B goes via the new firewall but the return traffic goes via the old router. The new firewall does not see any return traffic and thus drops the state, assuming it is invalid.

Proposed Solutions

Add a static route for machine A, on machine B, via the new firewall. This works fine, except it's a nightmare to maintain as this would need to be done on every machine that communicates with those machines which have been migrated.

Add a static route for machine A on the old router, via the new firewall. This poses a problem because the route will (usually) send the return traffic into the firewall on a different interface than it came out of. As I understand it, Juniper SRX devices track firewall states in zones (which are a set of interfaces) and return traffic will not match a state (and thus will not pass) unless it comes into the same zone. We have 1 zone per subnet.

Question

Presumably people have implemented firewalls into existing networks before. What's the solution here?

Improve this question
8
  • Usually, you set up the new network equipment, then switch over the cables to it after hours, and test. The phased approach is usually far more trouble than it is worth, and you have problems the whole time you are phasing things in. A quick change (with a proper backout plan) often works best.
    – Ron Maupin ♦
    Oct 5, 2016 at 17:43
  • why would the return traffic enter a different interface of the FW, in your second scenario? Maybe we're thinking of different ways to connect the router to the FW. If you just consider one interface of the FW the "old network" (aka the router with the not-yet-migrated subnets), and connect the router (via a new "router-firewall" vlan) to that interface, wouldn't that solve everything?
    – hertitu
    Oct 5, 2016 at 17:47
  • @hertitu - Return traffic, in the second scenario, would always enter the firewall on the same interface as the route from the old router would be configured with a single IP - i.e. the IP of a given interface on the firewall. So, if the route for 10.20.9.118/32 was set up to 10.20.6.254, the return traffic would always come in on the interface with 10.20.6.254 assigned to it regardless of the interface on which it left
    – phil-lavin
    Oct 5, 2016 at 18:48
  • @RonMaupin - understand your point but replacing a router with a firewall isn't quite so simple. Not least do all the firewall rules for every server need to be worked out and implemented but also applications need to be made resilient to connections timing out. It's become clear that many of our applications cannot tolerate this.
    – phil-lavin
    Oct 5, 2016 at 18:50
  • I don't understand. The firewall can replace the router with rules that allow all traffic as it is today. The hardware replacement is what you need to do at a single shot; having new and old network paths is just going to be a pain. You can come up with firewall rules, etc. later on.
    – Ron Maupin ♦
    Oct 5, 2016 at 19:40

1 Answer 1

Reset to default
2

As mentioned in the comments, I think there should be no problem if you create a single zone on your FW for the "old network", i.e. like this (for simplicity I've only shown 2 subnets/vlans):

enter image description here

Then when you migrate one subnet to the firewall it becomes like this:

enter image description here

I don't see any asymmetric routing here (traffic enters and leaves the correct FW interfaces); is there any other problem here?

Improve this answer
1
  • +1000 - If you have to do this in a phased manner, then adding a subnet between your current router and the firewall is the ONLY sane way to do this. Having two (non-VRRP) gateways in the same VLAN (if it isn't P2P) is a violation of Ben's Networking Law #3
    – Benjamin Dale
    Dec 5, 2016 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.